Skip to main content

Sumo Logic collection solution for netskope

Project description

sumologic-netskope-collector

Solution to pull data from Netskope to Sumo Logic

Installation

  1. Getting a token from Netskope portal

    • Login to Netskope as the Tenant Admin. Netskope REST APIs use an auth token to make authorized calls to the API. The token can be obtained from the UI by following the below steps
    • Go to the API portion of the Netskope UI ( Settings > Tools > Rest API)
    • Copy the existing token to your clipboard Alternatively, you can generate a new token and copy that
  2. Add a Hosted Collector and HTTP Source

    • To create a new Sumo Logic Hosted Collector, perform the steps in Configure a Hosted Collector.
    • Add an HTTP Logs and Metrics Source. Under Advanced you'll see options regarding timestamps and time zones and when you select Timestamp parsing specify the custom time stamp format as shown below: Format: epoch Timestamp locator: \"timestamp\": (.*),
  3. Method 1 - Configuring the sumologic-netskope collector Below instructions assume pip is already installed if not then, see the pip docs on how to download and install pip.

    sumologic-netskope-collector is compatible with python 3.7 and python 2.7. It has been tested on ubuntu 18.04 LTS and Debian 4.9.130. Login to a Linux machine and download and follow the below steps:

    • Install the collector using below command pip install sumologic-netskope-collector

    • Create a configuration file netskope.yaml in home directory using the sample.yaml file(in sumologic-netskope folder). Add the SUMO_ENDPOINT and TOKEN parameters obtained from step 1 and step 2 and replacing the "netskope domain" variable with your Netskope portal domain.

      SumoLogic:
        SUMO_ENDPOINT: <SUMO LOGIC HTTP URL>
      
      
      Netskope:
        TOKEN: <NETSKOPE API TOKEN>
        NETSKOPE_EVENT_ENDPOINT: <netskope domain>/api/v1/events
        NETSKOPE_ALERT_ENDPOINT: <netskope domain>/api/v1/alerts
      
      
      
    • Create a cron job for running the collector every 5 minutes by using the crontab -e and adding the below line */5 * * * * /usr/bin/python -m sumonetskopecollector.netskope > /dev/null 2>&1

    Method 2 - Collection via an AWS Lambda function To install Sumo Logic’s AWS Lambda script, follow the instructions below:

    • Go to https://serverlessrepo.aws.amazon.com/applications Search for “sumologic-netskope-collector” and select the app as shown below:

    • When the page for the Sumo app appears as shown below, click the Deploy button as shown below:

    • In the Configure application parameters panel, shown below:

      • NetskopeAlertEndpoint: Paste the Alert API endpoint <https://<you domain>/api/v1/alerts>
      • NetskopeEventEndpoint: Paste the Events API endpoint <https://<you domain>/api/v1/events>
      • SumoEndpoint: Paste the URL for the HTTP Logs source from step 2.
      • Token: Paste the API token from step 1.
    • Click Deploy.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for sumologic-netskope-collector, version 1.0.9
Filename, size File type Python version Upload date Hashes
Filename, size sumologic_netskope_collector-1.0.9-py3-none-any.whl (12.1 kB) File type Wheel Python version py3 Upload date Hashes View
Filename, size sumologic-netskope-collector-1.0.9.tar.gz (11.0 kB) File type Source Python version None Upload date Hashes View

Supported by

Pingdom Pingdom Monitoring Google Google Object Storage and Download Analytics Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page